Detect the creation or modification of common media file formats (e.g., .jpg, .png, .wav) following suspicious process activity like compression or encryption, especially when paired with lateral movement or exfiltration behavior.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Content (DC0085) | NSM:Flow | Session Transfer Content |
| Field | Description |
|---|---|
| FileExtensionFilter | Allows tuning of monitored file types (e.g., .jpg, .png, .docx). |
| PayloadEntropyThreshold | Threshold for flagging potential hidden data in outbound payloads. |
| ExecutionToExfilTimeWindow | Time window between media creation and network transmission. |
Unusual use of steganographic or media processing binaries (e.g., steghide, ffmpeg, imagemagick) followed by outbound communication to external IPs with high data output and media MIME types.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Network Traffic Content (DC0085) | NSM:Flow | Captured File Content |
| File Metadata (DC0059) | NSM:Flow | Observed File Transfers |
| Field | Description |
|---|---|
| ToolNameMatch | Specify which binaries to monitor (e.g., steghide, outguess). |
| OutboundTrafficPattern | Adjust based on known normal file upload services. |
Abnormal usage of Preview, ImageMagick, or binary editors to alter images/documents, followed by exfiltration or outbound connections with mismatched file MIME types or payload structure.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | macos:unified | File creation |
| Process Creation (DC0032) | macos:osquery | process_events |
| Network Traffic Content (DC0085) | NSM:Flow | C2 exfiltration |
| Field | Description |
|---|---|
| ParentProcessBaseline | Allow tuning based on expected apps calling image-editing tools. |
| TimeDelta | Gap between file manipulation and outbound connection. |
Suspicious modification of file artifacts (e.g., logs, ISO templates) on ESXi datastores, followed by beaconing or POST operations to external IPs potentially hiding payloads in file-like traffic.
| Data Component | Name | Channel |
|---|---|---|
| File Metadata (DC0059) | esxi:vmkernel | Storage access and file ops |
| Network Connection Creation (DC0082) | esxi:hostd | Service initiated connections |
| Network Traffic Content (DC0085) | NSM:Flow | Transferred file observations |
| Field | Description |
|---|---|
| FilenamePattern | Tune for likely stego file names (e.g., wallpaper.jpg, template.iso). |
| UnusualDestinationIP | Destination outside vCenter management subnet. |